Unlearning That Lasts: Utility-Preserving, Robust, and Almost Irreversible Forgetting in LLMs
On the map: LLM safety and security → Machine unlearning
Abstract (arXiv)
Unlearning in large language models (LLMs) involves precisely removing specific information from a pre-trained model. This is crucial to ensure safety of LLMs by deleting private data or harmful knowledge acquired during pre-training. However, existing unlearning methods often fall short when subjected to thorough evaluation. To overcome this, we introduce JensUn, where we leverage the Jensen-Shannon Divergence as the training objective for both forget and retain sets for more stable and effective unlearning dynamics compared to commonly used loss functions. In extensive experiments, JensUn achieves better forget-utility trade-off than competing methods, and even demonstrates strong resilience to benign relearning. Additionally, for a precise unlearning evaluation, we introduce LKF, a curated dataset of lesser-known facts that provides a realistic unlearning scenario. Finally, to comprehensively test unlearning methods, we propose (i) employing an LLM as semantic judge instead of the standard ROUGE score, and (ii) using worst-case unlearning evaluation over various paraphrases and input formats. Our improved evaluation framework reveals that many existing methods are less effective than previously thought.
Key facts. Cited by 11 papers in the map (data through 14 Oct 2026). Placed in Machine unlearning, one of 12 directions in LLM safety and security. Builds on 43 of its 52 references that are in the map. First posted on arXiv 2 Sep 2025.
Builds on
43 of 52 references.
Closest ancestors · 15
Same direction, newest first
- 2025OpenUnlearning: Accelerating LLM Unlearning via Unified Benchmarking of Methods and Metrics14 Jun
- 2025Towards LLM Unlearning Resilient to Relearning Attacks: A Sharpness-Aware Minimization Perspective and Beyond7 Feb
- 2024Simplicity Prevails: Rethinking Negative Preference Optimization for LLM Unlearning9 Oct
- 2024Position: LLM Unlearning Benchmarks are Weak Measures of Progress3 Oct
- 2024An Adversarial Perspective on Machine Unlearning for AI Safety26 Sep
- 2024MUSE: Machine Unlearning Six-Way Evaluation for Language Models8 Jul
- 2024RWKU: Benchmarking Real-World Knowledge Unlearning for Large Language Models16 Jun
- 2024Negative Preference Optimization: From Catastrophic Collapse to Effective Unlearning8 Apr
- 2024Rethinking Machine Unlearning for Large Language Models13 Feb
- 2024TOFU: A Task of Fictitious Unlearning for LLMs11 Jan
- 2023In-Context Unlearning: Language Models as Few Shot Unlearners11 Oct
- 2023Who's Harry Potter? Approximate Unlearning in LLMs3 Oct
3 more
Other references · 28
- 2024The Llama 3 Herd of Modelscited by 14,715
- 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 8,065
- 2020Measuring Massive Multitask Language Understandingcited by 7,963
- 2021TruthfulQA: Measuring How Models Mimic Human Falsehoodscited by 2,975
- 2017TriviaQA: A Large Scale Distantly Supervised Challenge Dataset for Reading Comprehensioncited by 2,955
- 2022Locating and Editing Factual Associations in GPTcited by 2,691
- 2024Phi-3 Technical Report: A Highly Capable Language Model Locally on Your Phonecited by 1,917
- 2022Challenging BIG-Bench Tasks and Whether Chain-of-Thought Can Solve Themcited by 1,807
- 2020Sharpness-Aware Minimization for Efficiently Improving Generalizationcited by 1,417
- 2022Editing Models with Task Arithmeticcited by 1,120
- 2024Refusal in Language Models Is Mediated by a Single Directioncited by 1,032
- 2024Length-Controlled AlpacaEval: A Simple Way to Debias Automatic Evaluatorscited by 897
16 more
- 2025Phi-4-Mini Technical Report: Compact yet Powerful Multimodal Language Models via Mixture-of-LoRAscited by 521
- 2024The WMDP Benchmark: Measuring and Reducing Malicious Use With Unlearningcited by 509
- 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attackscited by 486
- 2023Scalable Extraction of Training Data from (Production) Language Modelscited by 434
- 2021Enhanced Membership Inference Attacks against Machine Learning Modelscited by 248
- 2023Can Sensitive Information Be Deleted From LLMs? Objectives for Defending Against Extraction Attackscited by 158
- 2023Copyright Violations and Large Language Modelscited by 108
- 2023Identifying and Mitigating the Security Risks of Generative AIcited by 91
- 2024Long Is More for Alignment: A Simple but Tough-to-Beat Baseline for Instruction Fine-Tuningcited by 85
- 2023DEPN: Detecting and Editing Privacy Neurons in Pretrained Language Modelscited by 79
- 2021Generalized Jensen-Shannon Divergence Loss for Learning with Noisy Labelscited by 74
- 2023Unveiling the Implicit Toxicity in Large Language Modelscited by 51
- 2024JAILJUDGE: A Comprehensive Jailbreak Judge Benchmark with Multi-Agent Enhanced Explanation Evaluation Frameworkcited by 47
- 2023Knowledge Sanitization of Large Language Modelscited by 37
- 2023Towards Reliable Evaluation and Fast Training of Robust Semantic Segmentation Modelscited by 12
- 2024Rethinking How to Evaluate Language Model Jailbreakcited by 12
Built on by
Citing papers per year: 2025: 4; 2026: 7.
11 papers.
- 2026Metis: Memory Foundation Modelcited by 7
- 2025Understanding the Dilemma of Unlearning for Large Language Modelscited by 4
- 2025Downgrade to Upgrade: Optimizer Simplification Enhances Robustness in LLM Unlearningcited by 4
- 2025A Survey on Unlearning in Large Language Modelscited by 4
- 2025LLM Unlearning Under the Microscope: A Full-Stack View on Methods and Metricscited by 2
- 2026Detoxifying LLMs via Representation Erasure-Based Preference Optimizationcited by 1
- 2026Learning What to Forget: Improving LLM Unlearning via Learned Token-Level Importancecited by 1
- 2026Forget Narrowly, Retain Broadly: Unlearning as an Asymmetric Generalization Problemcited by 0
- 2026Crossing the Margin Cliff: Toward Relearn-Robust LLM Unlearning via Margin Calibrationcited by 0
- 2026GRACE:Gradient-guided Coreset Selection for LLM Unlearningcited by 0
- 2026RA2: Retain-Anchored Attraction Preserves Forget-Adjacent Utility in LLM Unlearningcited by 0
- 2026RA2: Retain-Anchored Attraction Preserves Forget-Adjacent Utility in LLM Unlearning14 Oct 2026
- 2026GRACE:Gradient-guided Coreset Selection for LLM Unlearning28 Aug 2026
- 2026Crossing the Margin Cliff: Toward Relearn-Robust LLM Unlearning via Margin Calibration30 Jul 2026
- 2026Metis: Memory Foundation Model29 Jul 2026
- 2026Forget Narrowly, Retain Broadly: Unlearning as an Asymmetric Generalization Problem10 Jul 2026
- 2026Learning What to Forget: Improving LLM Unlearning via Learned Token-Level Importance4 Jun 2026
- 2026Detoxifying LLMs via Representation Erasure-Based Preference Optimization24 Feb 2026
- 2025A Survey on Unlearning in Large Language Models29 Oct 2025
- 2025LLM Unlearning Under the Microscope: A Full-Stack View on Methods and Metrics8 Oct 2025
- 2025Downgrade to Upgrade: Optimizer Simplification Enhances Robustness in LLM Unlearning1 Oct 2025
- 2025Understanding the Dilemma of Unlearning for Large Language Models29 Sep 2025
Similar, not cited
Close in wording, no citation either way
- 2025BLUR: A Benchmark for LLM Unlearning Robust to Forget-Retain Overlap
- 2025LLM Unlearning on Noisy Forget Sets: A Study of Incomplete, Rewritten, and Watermarked Data
- 2026Unlearning in LLMs: Methods, Evaluation, and Open Challenges
- 2025Unlearning Isn't Deletion: Investigating Reversibility of Machine Unlearning in LLMs
- 2025SEPS: A Separability Measure for Robust Unlearning in LLMs
- 2023Unlearn What You Want to Forget: Efficient Unlearning for LLMs
- 2026Forgetting Only What Matters: Layer-Selective Unlearning toward Robust LLMs
- 2024Towards Robust Evaluation of Unlearning in LLMs via Data Transformations